On 26/07, Jonas Große Sundrup wrote:

Hi,

at the moment makepkg will use sudo to obtain root privileges if it is installed, otherwise it will use su. This means that if sudo is configured to only allow special commands (and none of those is "pacman"), "makepkg -i" will fail to install the built package. Same goes for installing dependencies with "makepkg -s".

The patch appended introduces a new variable into makepkg.conf named SUPER_USER_BINARY, which is set to "sudo" by default. With it being "sudo" makepkg will behave as it does currently, so there should be no breakages with updates. If not set to sudo, makepkg will ignore an installed sudo and use su right away.

If the user has access to the root password, why is their sudo commands so limited in the first place? -- Sincerely, Johannes Löthberg PGP Key ID: 0x50FB9B273A9D0BB5 https://theos.kyriasis.com/~kyrias/

On Jul 27, 2015 02:48, "Jonas Große Sundrup" wrote:

Johannes Löthberg wrote:

...

If the user has access to the root password, why is their sudo commands so limited in the first place?

For example one could use sudo to whitelist certain commands for certain users, whereas the administrator still uses su for general system maintenance (especially if the administrator is not really using that system and basically just uses the root-account for system maintenance; for building packages you could easily do "su pkguser" as root without needing a password and build packages that way).

If 'pkguser' is a dedicated user for building packages, why wouldn't it have sudo configured for properly building packages? If it's a shared user, make a dedicated user?

An other option is using sudo to whitelist network-related stuff to be able to switch networks or run "netctl-auto list" without entering a password etc. and use su for password-protected root-operations. If you combine that with an autologin for the user, the user doesn't even have to remember the userpassword.

This is irrelevant to makepkg configuration.

In both scenarios one would need su for packet installations while sudo is still installed.

Sorry, I'm still not understanding your use case and why this shouldn't be solved by properly configuring sudo.

On Mon, 27 Jul 2015 10:53:59 +0200 Jonas Große Sundrup wrote:

You could solve it by configuring sudo to use the user's password for maintenance, but I simply prefer using the root-password for system related stuff

sudo can be configured to ask for the target's password rather than your own. man sudoers look for "targetpw". I've only ever used it for a whole user, but according to documentation it's even possible to set it on a command by command basis. I don't know the syntax for that though.

Therefore the idea of giving the user the option to choose the super user binary to allow flexibility in that regard.

If you want to give flexibility you should rather use the value of the variable as the executable to call, not use it in a comparison that falls back to su if the value isn't sudo. That said I don't see the value in adding more complexity to makepkg when sudo can already do everything and more.

Convinced, consider the proposal withdrawn. ~ Jonas